Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Patches code
in dll
- yyhao.exe process, KERNEL32.dll module
Modifies file system
Creates the following files
- %TEMP%\105d5b
- scsi#disk&ven_msft&prod_virtual_disk#2&1f4adffe&0&000001#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
- physicaldrive2
- \device\harddiskvolume5
- %TEMP%\105862\yyhao.exe
- %WINDIR%\syswow64\hpsocket4c.dll
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- %WINDIR%\syswow64\libcurl.dll
- %WINDIR%\syswow64\libmatch.dll
- %WINDIR%\syswow64\libeay32.dll
- %WINDIR%\syswow64\yolo.dll
- %WINDIR%\syswow64\astart.dll
- C:\yöúêö\hk.exe
- C:\yöúêö\node.dll
- C:\yöúêö\y2\1.cfg
- C:\yöúêö\y2\1.json
- C:\herolist.json
- <Current directory>\èõö¾\2026äê6ôâ25èõ14ê±43·ö52ãë.txt
- <Current directory>\yöúêö.ini
Deletes following files that it created itself
- %TEMP%\105d5b
Modifies the following files
- C:\system volume information\mountpointmanagerremotedatabase
Network activity
Connects to
- 'ga##.gtimg.cn':443
TCP
Other
- 'ga##.gtimg.cn':443
UDP
- DNS ASK ga##.gtimg.cn
- DNS ASK 26.#o53.com
Miscellaneous
Searches for the following windows
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'RiotWindowClass' WindowName: 'League of Legends (TM) Client'
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
Creates and executes the following
- '%TEMP%\105862\yyhao.exe' <Current directory>
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop ShellHWDetection
- '%WINDIR%\syswow64\diskpart.exe' -s %TEMP%\105D5B
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '%WINDIR%\syswow64\sc.exe' start ShellHWDetection
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s +a %TEMP%\105862\libeay32.dll
- '%WINDIR%\syswow64\attrib.exe' +h +s +a %TEMP%\105862\libeay32.dll
- '%WINDIR%\syswow64\sc.exe' stop ShellHWDetection' (with hidden window)
- '%WINDIR%\syswow64\diskpart.exe' -s %TEMP%\105D5B' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ShellHWDetection' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s +a %TEMP%\105862\libeay32.dll' (with hidden window)
